Uploaded image for project: 'Cloud Enablement'
  1. Cloud Enablement
  2. CLOUD-2398

[RH-SSO] Refactor existing application templates for RH-SSO for OpenShift image to dynamically create necessary Java keystores/truststores in OpenShift

    XMLWordPrintable

Details

    • CLOUD Maintenance Sprint 16

    Description

      Currently available application templates for RH-SSO for OpenShift image expect the user to provide definition of:

      • SSL keystore,
      • JGroups keystore, and
      • SSL truststore

      in order the TLS (https) configuration for the image to work correctly. Since the SSL keystore / truststore and JGroups keystore configuration is not trivial, it creates initial barrier for image adoption / use.

      To lower this initial barrier, the RH-SSO application templates should be refactored to:

      • Utilize the OpenShift's internal / integral serving certificate secrets service functionality to generate the TLS certificate / key pair automatically,
      • Utilize re-encrypt TLS mode / route type instead the current passthrough one,
      • Use the OpenShift's init containers functionality to convert the previously generated PEM format based TLS certificate/key pair into PKCS12 format, and dynamically create necessary Java keystore/truststore from these.

      Demo implementation / blog about the idea:

      Other resources / examples:

      Attachments

        Issue Links

          Activity

            People

              rhn-jlieskov Ján Lieskovský
              rhn-jlieskov Ján Lieskovský
              Marek Schmidt Marek Schmidt
              Marek Schmidt, Pavel Drobek
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: